Improvements in and relating to identity allocation in a telecommunication network

Abstract

Dsclosed is a method of allocating a plurality, N, of identities to a user equipment, UE, wherein a telecommunication network provides the N identities in a message. A single encrypted message may be

Description

The present invention relates to improved means of allocating an identity to an element in a telecommunication network. 3GPP has agreed a study item for Release-19 which relates to Ambient Internet of Things (AloT) devices. The study is captured in 3GPP document TR 23.700-13. The following describes Key Issue (KI) #2 from the aforementioned document: “5.2 Key Issue #2: Identification, Subscription, Registration and Connection management 5.2.1 Description This Key issue pertains to the authorization and management of Ambient loT Devices to support Ambient loT services. Considering that Ambient loT Devices are a new type of reduced capabilities devices, the existing subscription model may not be suitable. Specifically, there is the need to study the device identification method to support Ambient loT devices which are under operator control. Based on the above consideration, the aspects to be studied in this key issue include: Study whether subscription management, registration management and / or connection management are necessary for an Ambient loT Device or a group of Ambient loT Devices, and if so identify the necessary state machine(s), procedures and functionality considering the Ambient loT Devices capability and characteristics. Study whether and how reachability and paging apply to Ambient loT Device(s) considering the Ambient loT devices capability and characteristics, and if so, what are the impacts. Study how to identify Ambient loT Device or group of devices and how to format the identifier. NOTE: NAS based Congestion control are not in the scope of this study. ” As can be seen, Kl#2 addresses device identification, reachability and paging. A solution has been proposed towards Kl#2 where a light weight algorithm is suggested to be used for locally generating a temporary identity at the User Equipment (UE) and the network. This then enables the UE and network to use a temporary identity for the UE without a need to explicitly assign and allocate an identity over the air. This proposal is known as “Solution #1: AloT Temporary Identifier Control” in the aforementioned document. Note that in the Fifth Generation System (5GS), one of the temporary identities is referred to as the 5G-GUTI (5G Globally Unique Temporary Identity). There are requirements to assign a new 5G-GUTI for a UE as indicated below from 3GPP TS 33.501 V18.1.0, “Security architecture and procedures for 5G system”: “Upon receiving Registration Request message of type "initial registration" or "mobility registration update" from a UE, the Access and Mobility Management Function (AMF) shall send a new 5G-GUTI to the UE in the registration procedure. Upon receiving Registration Request message of type "periodic registration update" from a UE, the AMF should send a new 5G-GUTI to the UE in the registration procedure. Upon receiving Service Request message sent by the UE in response to a Paging message, the AMF shall send a new 5G-GUTI to the UE. This new 5G-GUTI shall be sent before the current NAS signalling connection is released or the N1 Non-Access Stratum (NAS) signalling connection is suspended.” The main reason for allocating a new temporary identity (e.g. 5G-GUTI) after every paging procedure, and before the release of the NAS connection, is to minimize the ability of a rogue entity to track a user. If, for example, a UE uses the same temporary identity after being paged twice, then a rogue entity may be able to track the UE’s location based on the unmodified temporary identity. A problem in the prior art relates to a lack of an efficient method for allocating temporary identities while ensuring UE resources are not depleted. In particular, it can be expected that the security requirements of the 5G system continue to apply to AloT devices. For example, it should not be the case that AloT devices become prone to tracking much more than any other type of UE in the system. As such, it is expected that a device’s temporary identity will be re-allocated after every paging as has been explained above. AloT devices are expected to be limited in terms of resources such as power. It is therefore inefficient to allocate a new temporary identity after every paging procedure. The proposal set out above for a local algorithm in the UE and the network, where the algorithm generates a new temporary identity also has its drawbacks, especially in terms of power, since each generation of a new identity would require computational power to be used. With AloT devices being very limited in power, this procedure can lead to an undesirable increase in power usage if multiple paging procedures are performed for an AloT device. Due to the limitations of the current solutions for temporary identity allocation, embodiments of the present invention aim to provide a more efficient solution that does not require compute power and does not require signalling to be exchanged (for identity allocation) after every paging procedure. According to the present invention there is provided an apparatus and method as set forth in the appended claims. Other features of the invention will be apparent from the dependent claims, and the description which follows. According to a first aspect of the invention, there is provided a method of allocating a plurality, N, of identities to a User Equipment, UE, wherein a telecommunication network provides the N identities to the UE in a message. In an embodiment, the N identities are provided to the UE in a single message. In an embodiment, the single message is encrypted. In an embodiment, when one of the N identities is used, the UE and the network are aware of which one of the N identities is being used at any one time. In an embodiment, after use, the one of the N identities is discarded by the UE and the telecommunication network after use. In an embodiment, a next identity from the remaining plurality of identities is designated for use according to a predetermined scheme known to both the UE and the telecommunication network. In an embodiment, once a predetermined number of unused identities remains, the telecommunication allocates a new plurality of identities to the UE According to a second aspect of the invention, there is provided apparatus arranged to perform the method of the first aspect. According to one or more aspects of the present invention: • A set of temporary identities are provided to the UE, based on UE capabilities e.g. memory, and / or subscription • The UE and network determine a next temporary identity to be used either after paging or after the UE goes to connected mode on its own • The UE and network discard any identity that has been used and the rest of the identities are considered valid. The UE and network choose to use a next identity based on a specific order or as long as the identity is considered valid and has not yet been used • The network allocates a new set of identities before the last identity is used or after the last identity is used but before the UE’s connection is released • Any NAS or RRC or other protocol messages may be used for the proposals above • The identities may be used in conjunction with another fixed identity component, or they may be considered to be a full identity on their own The embodiments described herein are applicable to Ambient loT devices but should not be considered to be restricted to only these devices. As such any other UE may operate based on the proposals herein. All solutions can apply to one UE or a group of UEs. The term identity or identifier may refer to the same thing. The embodiments herein do not rely on a particular message format especially on the interface between the RAN (e.g. gNB, eNB or NG-RAN, etc.) and the AloT device, or between a UE and the AloT device, or between the AloT device and another AloT device, or between multiple UEs, RAN entities and / or AloT devices. As such all the details herein would apply regardless of how the message format is defined. What really matters is the type of information (or the contents of information) that is being sent and how the recipient acts upon it (or in response to receiving this information). Note that an AloT device may be referred to as a UE, or AloT device may be considered a special type or category of a UE. A UE may have at least AloT capabilities, or an AloT device can be a UE with restricted capabilities, etc. In one example, Carrier Aggregation (CA), MultiRadio Dual Connectivity (MR-DC), handover and its related features (e.g., CHO, DAPS, etc.) are not supported by AloT device. Additionally, the network may verify the capability of a given UE to be AloT capable device or support AloT capability. For all the embodiments herein, new subscription information may be defined to indicate if the UE and / or the network can behave as proposed by the solutions. Furthermore, the network and the UE may exchange any related capability indication to signal (indicate or report) that the node in question can operate as proposed herein. All messages or interactions between the UE and the network may be implemented using any protocol such as, but not limited to, NAS and / or RRC signalling / messages. Note that for all of the embodiments herein, any use of NAS or RRC message may be based on the existing NAS or RRC messages, or may be based on a new protocol message that may be defined for AloT devices or any other UEs. In summary, an embodiment of the invention may be described thus: • The network should allocate and provide more than one temporary identity to the UE, say N identities, where N is an integer e.g. 6 • The allocation of N identities can be sent to the UE in one message • The UE and the network will use one identity at time such that both entities know ahead of time which identity would be used next as will be described later Note that the temporary identity may refer to any temporary identity which may be used in the 3GPP system and / or in the 5GS such as but not limited to the 5G-GUTI or 5G-S-TMSI, or 5G-TMSI (Temporary Mobile Subscriber Identity). The 5G S-TMSI is a shortened version of the 5G-GUTI, designed to facilitate efficiency in radio signalling procedures such as Paging and Service Request. The 5G-S-TMSI is comprised of the AMF Set ID, AMF Pointer and 5G-TMSI Although a few preferred embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes and modifications might be made without departing from the scope of the invention, as defined in the appended claims. For a better understanding of the invention, and to show how embodiments of the same may be carried into effect, reference will now be made, by way of example only, to the accompanying diagrammatic drawings in which: Figure 1 illustrates a message flow illustrating an embodiment of the invention. An embodiment of the invention provides a new capability indication. The AloT device (or any type of UE) indicates its support for receiving (and / or handling, and / or storing, etc) more than one temporary identity at a time. The AloT device (hereafter referred to as UE, where UE is not limited to an AloT device only) may also indicate how many identities it can receive at a given time, where this may be based on memory or resources in the UE. The UE may determine the number, N, of identities which it can receive based on any one or more of the following: • The total available memory in the UE (where this may be volatile or non-volatile memory) • The length or size of the identity that is in question • Any other resource and any other combination of resources The UE indication may be sent in any message (e.g. NAS and / or RRC) using any field or information element (IE). For existing or newly defined RRC / NAS messages, new fields or lEs may be used, or existing fields or lEs can also be used. The network may also indicate to the UE whether (or not) it supports (or accepts) providing more than one identity to the UE at a given time. This indication may be provided in any message (e.g. NAS and / or RRC) and in any field or IE, whether it is new or existing. An indication from the network about its support of the feature, where the feature may refer to the allocation of at least one identity to a UE (at a given time and / or location) may also be considered by the UE as an acceptance by the network for the UE to use this feature when the network indeed provides e.g. more than one identity to the UE. An embodiment of the invention provides new subscription information. A new subscription information is defined for a UE (or a group of UEs) where this subscription can indicate whether (or not) the network is allowed to apply the feature to the UE, where the feature may be the allocation of at least one identity to a given UE (or group of UEs, e.g. as identified by a group ID) at a time and / or location. The subscription information may be defined (or stored) in any network node e.g. the Unified Data Management element, UDM, and may be provided to any other network function that serves the UE, where this network function may be an AMF or any equivalent which may be dedicated for AloT devices. The subscription information may also contain other information such as, but not limited to: • The number M, where M is an integer, representing the number of identities that can be allocated to a UE at a given time • The time duration TJd, representing the time after which the network should allocate another set of identity for the UE (or group of UEs) in question Embodiments provide for the allocation of more than one identity. The network may determine to allocate more than one temporary identity to a UE, where this determination may be based on any one or more of the following: • The capability indication from the UE indication that the UE can receive, process, handle, store, etc, more than one temporary identity • Subscription information indicating that the UE can be provided with more than one temporary identity • Local policies in the network which indicate that the UE (which may be part of a group of UEs, or a group of UEs) should be provided with more than one temporary identity When allocating more than one temporary identity, the network should determine the number M of identities that should be allocated, where M may be an integer. The network may determine the value of M based on any of the following: • The number indicated in the subscription information, where this number may be associated with a time period e.g. T_id, where TJd may represent the duration or period after which the network should re-allocate a new set of identities • The indication from the UE, such as: o The number N of identities that the UE can handle or save, etc o The resource information in the UE e.g. available memory, etc Based on the determination as set out above, the network may allocate a new set of temporary identities for a UE, where this information may be sent to the UE during any of the following procedures or transactions: • Registration procedure: the network provides this information as part of the procedure that the UE registers with the network, where this registration may be initial registration or any other registration (such as periodic updates), etc. It should be noted that AloT devices may perform other procedures that are equivalent to registration and hence may not be referred to as registration. These procedures may be validation, authentication, security procedures, etc. Hence the proposals herein are not to be restricted by the named used and therefore may apply for procedure. The network should allocate the set of identities before the connection is released or before the transaction is considered finalized • Establishment of a connection or transaction following a paging or a network initiated request based on which the UE responds to the network. During this procedure, the network may allocate a new set of identities, preferably before the connection is released. The network may use any message to do so (e.g. NAS and / or RRC, or any new protocol messages that may be defined for AloT). For all of the above, or during any other procedure (although not necessarily explicitly listed herein) in which the network determines to provide more than one identity to a UE, the network should do so using a secured manner. In other words, the transmission of the set of identities should occur using a secured message. When sending the set of identities to the UE, the network should indicate how many identities are present in the set. This may be achieved by means of dedicated fields that indicate the total number of identities which are sent to the UE. Once a plurality of identities has been allocated by the network to the UE, it is important that there is synchronisation between the UE and the network, such that each entity can be sure it is using the correct one of the plurality of allocated identities. When allocating a set of N identifiers, where N is an integer, the network and the UE should use one identity at a time in the order in which it is received. The order may be known to both the UE and the network or may be encoded such that a specific order is defined which indicates the first identity in the set, the second identity in the set, etc, and the Nth identity in the set. With this, the UE and the network should use one identity at a time. When a new identity is to be used, the UE and the network would determine the next identity based on the order received and then use this as the next identity, and so on. After an identity is used, the UE and the network would discard the used identity and determine a next identity to be used. The UE and the network should optionally not use the same identity twice when communicating especially after the UE enters connected mode and then goes to idle mode. The following rules may be defined for the network when allocating a new set of identities. The rules determine when a previously assigned (and optionally already used) identity can be allocated again: • After a certain time elapses, e.g. as determined by local policies in the network or subscription information • After the UE moves to a different location or area, where the area or location may be any method to determine UE locality e.g. based on coordinates, shape of an area, etc • After the UE moves a certain minimum distance from the last location where the identity set was provided Figure 1 shows an exemplary call flow of an embodiment, noting that the steps may be performed in a different order or combination. As such the figure is to be considered as an example only and the skilled person will readily appreciate that certain changes may be made without departing from the scope the invention, defined in the appended claims. The procedure in Figure 1 describes how to support allocation of multiple temporary identities to AloT devices is described step by step below. The three physical entities are AloT device 100, RAN Reader (Base Station) 110 and AMF / AloT NF 120. 1. The AloT 100 device sends a registration / validation request to the AMF (or AloT NF) 120. The request includes a capability indication for receiving multiple temporary identifiers. Optionally, the request may also include the maximum number of temporary identifiers that can be stored at the AloT device. 2. The AMF (or AloT NF) 120 allocates a set of temporary identifiers to the AloT device 100 with N entries. The allocation may be performed based on device capability, subscription, or local policy. 3. A registration / validation response is sent by the AMF (or AloT NF) 120 to the AloT device 100 including the set of allocated temporary identifiers with N entries. 4. The AloT device 100 stores the set of N temporary identifiers in the same order they were received in step 3. For example, if N identifiers were received, they should be stored so that the first identifier to be used is Temp ID#1, then Temp ID#2..., and lastly Temp ID#N. 5. A paging is sent from AMF (or AloT NF) 120 to the AloT device 100 via the RAN reader 110 including the first temporary identifier, i.e. Temp ID#1. 6. A NAS response message (e.g. control plane service request, service request, etc) is provided by the AloT device 100 including the temporary identifier contained in step 5, i.e. TemplD#1. 7. The temporary identifier in steps 5 and 6 is deleted locally both at the AloT device 100 (see step 7a) and AMF 120 (or AloT NF, see step 7b). In both cases, the next temporary identifier is set to be the next one in the set received in step 3, i.e. Temp ID#2. 8. The connection with the AloT device 100 is released or the transaction / service is completed. 9. Steps 5 to 9 are repeated upon a new need for paging. Both the AloT device 100 and the AMF (or AloT NF) 120 locally delete any temporary identifier that has been used. 10. Once the full set of identifiers have been used and deleted, the procedure is repeated from step 2 with a new set of temporary identifiers being allocated by the AMF / AloT NF 120 to the AloT device 100 before the connection is released. Note that in Figurel, the RAN reader (BS) 110 may be any suitable logical function e.g. gNB, NG-RAN, UE in the middle, a combination of UE and RAN, etc. It need not be a distinct physical entity in its own right. Note that in an alternative embodiment, when the UE or the network use the set of allocated identities, they may do so in any order. However when one identity is used, it should be discarded and then the rest of the identities can be used for selection or use of the next identity. Hence the order of use of the identity is not relevant as long as the identity is used once and then locally discarded. As such, when an entity (UE or network) uses an identity, the recipient (network or UE) should simply verify if the identity is part of the valid set i.e. the set containing identities which have not been used yet. The UE or network can respond with the same identity but only using it once. The UE and network can then discard the identity which has been used and then consider that the remaining identity or identities are valid. The network should allocate a new set of identities at some predetermined time, such as when only one identity remains or after the last identity is used. Note that in all cases: • The temporary identity may be considered a full identity on its own • The temporary identity may be used in conjunction with another identity i.e. either in front of the other identity or after the other identity, so that another identity is formed by this combination • When responding on the lower layers or over the air message (e.g. RRC message), a part of the temporary identity is used. This may also be applicable to NAS messages Note that the descriptions set out above are also applicable for the case when the UE enters connected mode without being paged. For example, in mobile originated connections, the UE may use the next valid identity to identify itself. The network may simply verify the identity to be valid or not. If valid, the network can process the request or message from the UE. Upon release of the connection, the UE and the network discard the identity that was used by the UE in the last connection and hence determine a new next identity which can be used in either mobile originated messages or terminated cases in which the UE responds to a message. In an alternative, the network may indicate to the UE if the same identity can be used more than once for mobile originated connections. The UE may then determine to use the identity more than once (or not) based on this indication from the network. The network may set the number of times that the UE can use the identity for mobile originated requests. The UE and network may then discard the identity in question after the maximum number of usage times has been reached by the UE for mobile originated cases. The next identity to be used may be determined as has already been set out. For the sake of completeness, Figure 2 illustrates a method of an embodiment of the invention. At step 11, the network allocates a plurality, N, of identities to a UE in a single encrypted message. At step 12, one of the N identities is used. The network and the UE are aware of which one of the N identities is used. At step 13, the used identity is discarded by both the UE and the network. At step 14, a new identity is selected from the remaining identities, according to a scheme known to both the UE and the Network. At step 15, at a predetermined threshold, a new plurality of identities is allocated to the UE. At least some of the example embodiments described herein may be constructed, partially or wholly, using dedicated special-purpose hardware. Terms such as ‘component’, ‘module’ or ‘unit’ used herein may include, but are not limited to, a hardware device, such as circuitry in the form of discrete or integrated components, a Field Programmable Gate Array (FPGA) or Application Specific Integrated Circuit (ASIC), which performs certain tasks or provides the associated functionality. In some embodiments, the described elements may be configured to reside on a tangible, persistent, addressable storage medium and may be configured to execute on one or more processors. These functional elements may in some embodiments include, by way of example, components, such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. Although the example embodiments have been described with reference to the components, modules and units discussed herein, such functional elements may be combined into fewer elements or separated into additional elements. Various combinations of optional features have been described herein, and it will be appreciated that described features may be combined in any suitable combination. In particular, the features of any one example embodiment may be combined with features of any other embodiment, as appropriate, except where such combinations are mutually exclusive. Throughout this specification, the term “comprising” or “comprises” means including the component(s) specified but not to the exclusion of the presence of others. Attention is directed to all papers and documents which are filed concurrently with or previous to this specification in connection with this application and which are open to public inspection with this specification, and the contents of all such papers and documents are incorporated herein by reference. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and / or all of the steps of any method or process so disclosed, may be combined in any combination, except combinations where at least some of such features and / or steps are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. Thus, unless expressly stated otherwise, each feature disclosed is one example only of a generic series of equivalent or similar features. The invention is not restricted to the details of the foregoing embodiment(s). The invention extends to any novel one, or any novel combination, of the features disclosed in this specification (including any accompanying claims, abstract and drawings), or to any novel one, or any novel combination, of the steps of any method or process so disclosed.

Claims

1. A method of allocating a plurality, N, of identities to a User Equipment, UE, wherein a telecommunication network provides the N identities to the UE in a message.

2. The method of claim 1 wherein the N identities are provided to the UE in a single message.

3. The method of claim 2 wherein the single message is encrypted.

4. The method of any preceding claim wherein when one of the N identities is used, the UE and the network are aware of which one of the N identities is being used at any one time.

5. The method of claim 4 wherein, after use, the one of the N identities is discarded by the UE and the telecommunication network after use.

6. The method of claim 5 wherein a next identity from the remaining plurality of identities is designated for use according to a predetermined scheme known to both the UE and the telecommunication network.

7. The method of claim 6 wherein once a predetermined number of unused identities remains, the telecommunication allocates a new plurality of identities to the UE8. Apparatus arranged to perform the method of any preceding claim.

Images